Identity Theft- A fraud that is committed or attempted, using a person's identifying information without authority.

Preparer Fraud: Return Preparer Fraud generally involves the orchestrated preparation and filing of false income tax returns (in either paper or electronic form) by unscrupulous preparers who may claim, for example:

The preparer's clients may or may not have knowledge of the false expenses, deductions, exemptions and/or credits shown on their tax returns.

Personally Identifiable Information (PII). The definition of personally identifiable information is provided by OMB 07-16. For further information about PII, see the Privacy, Governmental Liaison, Disclosure (PGLD) web page called PII - What is personally identifiable information?.

Incident - Throughout this IRM, the term “incident” refers to an occurrence or event involving identity theft as it applies to a specific tax year(s) as reported by the taxpayer.

For a full listing of Identity Protection terms, see Exhibit 10.5.3-1, Glossary of Identity Protection Terms and Definitions.

Federal agencies have been instructed by the Office of Management and Budget (OMB) and the Department of the Treasury to address the increasing occurrence of identity theft.

The Identity Protection Program was created in response to these directives and recommendations and to ensure IRS compliance with the President's Identity Theft Task Force Report.

Identity theft creates a heavy financial and emotional toll on its victims and severely burdens our economy. Because the IRS touches almost all Americans, we developed an Identity Protection Vision document to combat tax-related fraud and to assist taxpayers who are identity theft victims. The IRS is focused on prevention and assistance activities including a comprehensive approach to protecting taxpayer information. The IRS will enhance efforts through three primary goals:

Identity Protection - This office in Privacy, Governmental Liaison, and Disclosure (PGLD) has the following specific responsibilities related to administering the Identity Protection Program in IRS:

The Identity Protection Office supports servicewide efforts to recognize and resolve identity theft issues while striving to provide a uniform and consistent approach to victim assistance. This includes internal outreach to all Business Operating Divisions to ensure the established policies are implemented and supported servicewide.

Non-Tax Related Identity Theft - If you think you might be at risk of identity theft due to a lost or stolen purse or wallet, questionable credit card activity or credit report, you should contact the IRS Identity Protection Specialized Unit to take steps to secure your account.

Tax Related Identity Theft -

All taxpayers desire and expect courteous service. Taxpayers who have experienced identity theft are already victims, either emotionally or financially. IRS employees need to be aware of that impact and handle the contact with an additional level of sensitivity and understanding.

Victims can suffer far more than the loss of their money or ruin of their credit. Loss of employment and inability to obtain housing are just a few examples of how identity theft can threaten a victim’s basic needs.

In addition to providing the taxpayer with courteous service, you should educate the taxpayer as to how to protect themselves and where to find additional information:

For additional information see IRM 21.9.2.3, Identity Theft - Telephone Interview.

Taxpayers meeting Taxpayer Advocate Service (TAS) Criteria 1-4 (economic burden), will be referred to the TAS, see IRM 13.1.7.2, TAS Case Criteria.

Generally, IRS will refer TAS Criteria 5-7 cases to IPSU for resolution. Refer to IRM 21.9.2.9, Identity Theft Assistance Request (ITAR) - General Information, for the IPSU criteria.

Research should be performed and documented prior to reaching a final determination of identity theft. Research using Command Codes (CC) ENMOD, IMFOL, RTVUE, NAMES, INOLE, DUPOL, FFINQ, REINF, and IRPTR.

The first step to tracking and reporting identity theft incidents is through the use of Identity Theft Tracking Indicators. Identity theft can be tax related or non-tax related. Identity theft cases can be found in virtually any BOD/Function inventory.

In situations where the taxpayer makes an allegation of identity theft or when the IRS initially suspects that identity theft may have occurred, IRS functions will move the case into their identity theft inventory. Accounts will be marked using the appropriate identity theft tracking indicator.

Moving cases into identity theft inventory provides victims with a treatment stream for case resolution specific to identity theft.

The Identity Protection Program developed identity theft indicator codes to track identity theft incidents. Each indicator is input as a Transaction Code (TC) 971 with Action Code (AC) and is displayed on Integrated Data Retrieval System (IDRS) via command codes ENMOD or IMFOL with definer "E" of the affected taxpayer's account. For accounts not available on IDRS, command code IMFOLE will display the identity theft tracking indicators.

Identity theft tracking indicators are used to mark both tax-related and non-tax related incidents of identity theft and they help us to identify open and closed cases. While some action codes are used to track the progression of inventory (522) others provide taxpayer protections (501 and 506).

In January 2012, PGLD expanded the use of identity theft markers to facilitate Servicewide tracking and reporting of identity theft incidents. These indicators, or markers, capture identity theft inventory from the initial taxpayer allegation to account resolution. Each indicator is input as a Transaction Code (TC) 971 with an Action Code (AC) and Tax Administration Source Code.

The AC and Tax Administration Source Code is dependent upon the facts and circumstances of the case.

An initial allegation or suspicion of identity theft can be recognized by either the taxpayer or the service. PGLD developed tracking indicators to mark taxpayer accounts when the identity theft incident is initially alleged or suspected.

Two new Tax Administration Source codes were developed to track cases as they are initially identified:

Prior to marking an account with TC 971 AC 522 PNDCLM or IRSID, research ENMOD/IMFOLE to ensure the account has not already been marked for the same tax year/incident. If the coding already exists, do not input a second code for the same tax year/incident.

Do not apply the AC 522 PNDCLM or IRSID to the SSN of a taxpayer when an ITIN taxpayer reports the misuse of the SSN. See IRM 10.5.3.2.10 (1) d.

Taxpayers will notify the IRS when they believe they may have experienced an identity theft incident. In these instances, taxpayers alleging to be victims of identity theft will be required to provide documentation to substantiate identity theft incidents as detailed below:

Form 14039 is used to report both tax-related and non-tax related identity theft issues. The Form 14039 can be filed by either mail or fax following the instructions provided on the second page of the Form 14039.

If taxpayers do not provide substantiation documentation when requested, proceed with case resolution assuming the taxpayer is not an identity theft victim. See IRM 10.5.3.2.8, Reversing Pending Identity Theft Claims - TC 972 AC 522 NORPLY or NOIDT.

Substantiation Documentation can be accepted from the taxpayer or someone who has power of attorney for the taxpayer (e.g., Form 2848, Power of Attorney and Declaration of Representative). Form 14039 requires a taxpayer signature. See IRM 10.5.3.2.7.2, Complete and Legible Documents for additional information.

Documents must be secured and handled in the same manner as other sensitive taxpayer information.

The business unit function that is assigned the identity theft case (relevant open control) or issued the notice/letter relating to the identity theft (CP 2000, Audit Notice, Letter 239C, etc.) is responsible for collecting substantiation documentation in a timely, accurate, and secure manner, if applicable.

After the receipt of the taxpayer's documentation, IRS will need to research the case to verify the taxpayer's claim. If it is later determined that identity theft did not occur, reverse the TC 971 AC 522 (see IRM Exhibit 10.5.3-13 TC 972 AC 522 - Reversal of the TC 971 AC 522).

Acknowledge receipt of Form 14039 within 30 days of the IRS received date.
If you are closing the case within 30 days of receipt, the closing contact will act as both an acknowledgement of receipt of the taxpayer's documents and the closing contact.

Taxpayer accounts displaying a TC 971 AC 522 with any one of the following Tax Administration Source Codes:

indicate the taxpayer provided complete and legible documentation supporting identity theft for a specific tax year. See IRM 10.5.3.2.7.3, Marking Taxpayer Accounts When Accepting Identity Theft Supporting Documents.

A taxpayer is required to provide substantiation documentation to the IRS only once per incident. Any business unit that requires substantiation documentation for an identity theft incident should use this documentation.

Substantiation documentation is valid for a period of three years from the date IRS receives and processes the documentation. If the taxpayer experiences a new identity theft incident after that period, the taxpayer will need to submit new substantiation documentation.

Substantiation documentation may be submitted for one or more tax years.

There may be situations when it is necessary to reverse a pending identity theft claim.

A pending identity theft claim is an account with an unreversed TC 971 AC 522 and no subsequent TC 971 AC 50X.

Taxpayer Does Not Respond to Requests For Supporting Documentation - NORPLY: In situations where the taxpayer alleges identity theft and has not provided the supporting documents as requested, mark the taxpayer's account using Command Code (CC) REQ77 initiated from ENMOD to input a TC 972 AC 522 reflecting a Tax Administration Source Code NORPLY, and the tax year of the identity theft incident. See Exhibit 10.5.3–13 for additional information.

Identity Theft Did NOT Occur - NOIDT: In the course of resolving an identity theft allegation, it is determined that identity theft did not occur, it will be necessary to reverse the pending claim. Employees will mark accounts where it is determined that identity theft did not occur, using Command Code (CC) REQ77 initiated from ENMOD to input a TC 972 AC 522 reflecting a Tax Administration Source Code NOIDT, and the tax year of the identity theft incident. See IRM Exhibit 10.5.3-13 for additional information. Follow your IRM procedures to notify the taxpayer of actions you took to resolve the issues.

Case Closure Analysis: Perform case closure analysis to ensure all identity theft related issues have been addressed and resolved. This includes but is not limited to:

Issues identified during case closure analysis should ONLY be referred to another function when the case can not be resolved within your function.

Back-End Work - For the purpose of identity theft case resolution as described in IRM 10.5.3, back-end work consists of actions needed to finish case resolution. These actions have no affect on the taxpayer (victim of identity theft). The following outstanding issues are considered back-end work:

The employee assigned will have resolved the taxpayer's (victim's) account which includes:

The input of the AC 50X will not, in every case, coincide with the closing of the control base. There may be additional back-end work to be completed before the control base can be closed. Do not wait until all the additional back-end work is completed before inputting the protective TC 971 AC 501 on the taxpayer's account, for example completing TC 400 procedures.

The AC 501 cannot be input until the taxpayer is no longer harmed by identity theft issues impacting tax administration. The TC 501 indicates all identity theft tax administration issues have been resolved from the taxpayer's perspective.

A case control must be maintained until all back-end work is completed.

Prior to moving a case into back-end casework, the outstanding issues must be cleared through the Office of Privacy, Governmental Liaison and Disclosure (PGLD) if they are not addressed in 10.5.3.2.9(3). Your Headquarters representative from your functional area will coordinate with PGLD.

The employee assigned the case will close the identity theft issue by marking the account with either a TC 971 AC 501 for taxpayer initiated identity theft supported by taxpayer provided documentation or a TC 971 AC 506 for IRS identified identity theft (no documentation required). These action codes (501 and 506) provide the taxpayer protection against future occurrences of identity theft.

To indicate resolution of a taxpayer initiated identity theft claim supported by documentation, mark the victim's account using Command Code (CC) REQ77 initiated from ENMOD, to input a TC 971 AC 501 reflecting an appropriate Tax Administration Source Code depending upon the facts and circumstances of the case along with the tax year of the identity theft incident. The AC 501 is applied to a taxpayer's account when all of the following occur:

TC 971 AC 501 can be input by any business unit delegated the authority and programmed to use this code when closing identity theft issues supported by taxpayer documentation.

There can be more than one TC 971 AC 50X input or present for different functions in the same year.

There can be more than one TC 971 AC 501 input or present for different tax years by the same business function.

If the taxpayer during his/her initial inquiry stated more than one tax year was affected by identity theft, the function working the taxpayer's issue will review the entity to ensure accounts marked with a TC 971 AC 522 have been resolved. If more than one year is affected by identity theft and resolved, the employee will enter the corresponding TC 971 AC 50X for each year. However, if it is determined that a tax-related identity theft did not occur in one of the previously reported tax years, the employee would reverse the TC 971 AC 522 using the appropriate reversal code, see IRM 10.5.3.2.8, Reversing Pending Identity Theft Claims - TC 972 AC 522 NORPLY or NOIDT.

Functional employees assist taxpayers who are, or may become, victims of identity theft. Some functions have unique procedures for identity theft case resolution.

TC 971 AC 506 is applied to a taxpayer's account when the IRS identifies identity theft incidents that affect tax administration. Such incidents can result from any of the following:

Prior to marking the taxpayer's account with a TC 971 AC 506 the function MUST ensure all corrective actions have been taken which includes:

Refer to IRM 21.6.2.4.2. Multiple Individuals Using the Same TIN.

TC 971 AC 506 is limited and reserved for use by the following functions:

The TC 971 AC 506 indicator is visible on ENMOD and IMFOLE. For input instruction see IRM 10.5.3-11.

The function that inputs the TC 971 AC 506 will notify the taxpayer (victim), by letter, that someone may have attempted to use his or her SSN. This victim notification letter will include:

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡
Any tax return that is identified through the filtering process as potentially fraudulent will become unpostable, i.e., removed from the posting process. This unpostable return is systemically routed to Submission Processing for screening to determine whether the return is legitimate.

In some instances, it may be necessary to manually reverse TC 971 AC 506. If reversal (TC 972 AC 506) is indicated, see Exhibit 10.5.3-11 for a description of reasons for the reversal.

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡
≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

The TC 971 AC 524 is an identity theft indicator that prevents a taxpayer’s TIN (SSN or ITIN) from being used as the primary or secondary TIN on a current or subsequent year federal income tax return. Account locks can be applied both manually and systemically using internal or external information. However, input of the TC 971 AC 524 is limited and reserved for use by Privacy, Governmental Liaison and Disclosure (PGLD) Identity Protection Program (IP) and RICS Taxpayer Protection Program (RICS TPP).

TC 971 AC 524 can be viewed on the taxpayer’s entity using command codes ENMOD or IMFOLE.

TC 971 AC 524 is used to lock the account of deceased taxpayers.

The identification, development, and implementation of specific population categories for the TC 971 AC 524 will be phased in by PGLD with the goal of creating a comprehensive list of taxpayers who do not have a filing requirement. Accounts locks may be initiated either manually or systemically.
Manually locking decedent accounts occurs when a date of death is present on the tax module and the account is identified by CI or Integrity & Verification Operations (IVO) as fraudulent.
Systemically locking decedent accounts occurs when a taxpayer files a final return for the year of death.

Systemic Locking of Deceased Taxpayer accounts occurs when all of the following are true:

Manual Locking occurs when individual accounts are identified by a business function and provided to PGLD or RICS for input using a systemic tool.

Returns filed on decedent accounts containing an unreversed TC 971 AC 524 DECD, will be prevented from processing.
Electronically filed returns

Paper Filed Returns

Input of a TC 972 AC 524 will reverse a TC 971 AC 524 and will “unlock” the account. Input of the TC 972 AC 524 is limited and reserved for:

To unlock a decedent account a taxpayer must provide information to support their request.

If a taxpayer contacts IRS relating to a locked account and there is a Date of Death (DOD) on the account and an unreversed TC 971 AC 524 DECD is present, ALL of the following documentation MUST be provided by the taxpayer:
The original Letter SSA 2458 from the Social Security Administration showing the correction to the date of death;
A photocopy of at least one of the following:

A copy of their tax return with an original signature(s);

Instruct the taxpayer to send all of the above information to the same service center the taxpayer used to file his or her original tax return.

If a taxpayer contacts IRS relating to a locked account and there is no longer a Date of Death (DOD) on the account and an unreversed TC 971 AC 524 DECD is present on the entity, refer the case to Submission Processing Entity (no taxpayer documentation is required).
See IRM 3.13.5 for additional information.
See IRM 10.5.3-17, TC 972 AC 524 – Reversal of TC 971 AC 524 for additional information

Once a correction has been made removing the DOD, Entity will notify the PGLD IP Analyst to reverse the AC 524.

In January 2011, the IRS initiated a pilot program to issue an Identity Protection Personal Identification Number (IP PIN) to select taxpayers with an active identity theft indicator (TC 971 AC 501, TC 971 AC 504, and some TC 971 AC 506) on their account. The IP PIN is a single use identification number.

The Identity Protection PIN is valid for the current processing year only. If the taxpayer wishes to file a TY 2011 return see paragraph (7) below.

Electronic Filing - Taxpayers filing electronically will be prompted by their software to input their IP PIN. If a taxpayer was issued an IP PIN and does not use the IP PIN, or the IP PIN input is incorrect, the e-filed return will reject.

Filing on Paper - Taxpayers filing Individual Income Tax paper returns (Form 1040, 1040A, and 1040EZ), will place the IP PIN into the 6 boxes just to the right of the spouse’s occupation labeled “Identity Protection PIN”. Paper returns that require an IP PIN but are filed with a missing or incorrect IP PIN, will be routed to the Unpostable Unit for manual review to validate the taxpayer’s identity prior to acceptance.

If a taxpayer loses or misplaces the IP PIN, the IRS may provide a replacement IP PIN. See IRM 10.5.3.2.16.1, Lost, Misplaced or Non-Receipt of IP PIN.

Tax year 2012 Returns

Tax Year 2011 Returns

If a taxpayer contacts IRS stating they received a CP 01F or a CP 01A and they do not have a filing requirement, advise the taxpayer that the IP PIN will protect their account from misuse.

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡ ≡

≡

Input of TC 971 AC 505 is limited and reserved for use by Privacy, Governmental Liaison and Disclosure (PGLD) employees. However, this indicator will be visible and available for reference on the individual’s account. See Exhibits 10.5.3-8 and 10.5.3-9 for more information about this indicator.

TC 971 AC 505 is applied to a taxpayer’s account when all of the following occur:

The taxpayer will receive a data loss notification Letter 4281 C, IM Breach Notification Letter) from the IRS advising him/her that information controlled by the IRS may have been disclosed to unauthorized individuals. The notification letter contains information related to identity protection and free credit monitoring products arranged for the taxpayer by the IRS. Note: The taxpayer must call the credit-monitoring agency in order to sign up for the services. Refer to IRM 21.9.2.8, Notification 4281C Letter to Impacted Individuals.

PGLD inputs TC 971 AC 505 on an account regardless of the existence of any other identity theft indicator code (AC 501, 504, or 506) that may be present on the account. In some instances, it may be necessary for PGLD personnel to manually reverse the TC 971 AC 505.

For information on the Incident Management Program see IRM 10.5.4.4, Responding: The Incident Management Breach Process, IRM 10.5.4, Incident Management Program. For information on the IRS data loss process, see that same IRM section, or view the Incident Management Breach Process flow chart.

TC 971 AC 504 is applied to a taxpayer’s account when the taxpayer contacts the IRS claiming that he or she is a victim of identity theft, and there is no known affect to tax administration.

TC 971 AC 504 will be visible for reference in the event the incident becomes a tax administration concern. See Exhibit 10.5.3-6 and Exhibit 10.5.3-7 for information regarding this indicator.

Input of this indicator is limited and reserved for use by the Identity Protection Specialized Unit, IPSU (see note below), which is comprised of two key functions:

See IRM 21.9.2.2, Identity Theft-Expanded Procedures, for additional information regarding the duties and responsibilities of the IPSU.

If IRS employees are contacted by a taxpayer indicating a non-tax related identity theft, see IRM 21.9.2.3, Identity Theft - Telephone Overview and IRM 21.9.2.4, Identity Theft - Paper Overview. .

In some instances, it may be necessary to manually reverse TC 971 AC 504. If reversal is indicated (TC 972 AC 504), see Exhibit 10.5.3-7 for a description of reasons for the reversal.

The Technical Working Group for Identity Theft Victim Assistance (TWG) is a cross-functional group that discusses unique identity theft cases where the taxpayer has been unduly burdened. The TWG was established through a collaborative effort with TAS, and is facilitated by the Identity Protection Program.

The overall purpose of the TWG is to provide a forum for developing recommendations on how processes and procedures can be improved to address and reduce the burden on taxpayers who are victims of identity theft. The TWG's responsibilities include:

The TWG meets periodically and is comprised of representatives and subject matter experts from the various business units and functions. During the meetings, TWG participants discuss a taxpayer identity theft case and provide analysis and function-specific insight regarding existing processes and procedures pertaining to the case and taxpayer treatment. Through this discussion, the group suggests ideas to improve existing procedures and/or provides recommendations for procedures that may need to be developed.

The TWG provides a forum for discussing systemic and procedural issues and developing recommendations and solutions on how processes and procedures can be improved to reduce taxpayer burden with regard to issues of identity theft. The function of the TWG is NOT to address specific taxpayer related identity theft issues, but rather to deal with systemic/procedural issues.

The TWG encourages functions to submit systemic and procedural issues of identity theft that cannot be resolved at the functional level, to the TWG. Issues identified by functions will first follow the issue escalation process of their respective organization. If an issue cannot be resolved through the functional channels, but meets the systemic/procedural issue criteria shown in IRM 10.5.3.3.1 (6) and (7) below, the functional liaison to the TWG will document the issue using the Issue Submission Template. The functional liaison will E-mail the completed Issue Submission Template to the following E-mail address: PIPDS.IPIM.TWG@irs.gov. Refer to the Identity Theft website link TWG Issue Submission Template for the template to be used for this purpose.

An Identity Protection staff member will monitor the issue submission mailbox regularly. The Monday before the TWG meeting (meetings held monthly), an Identity Protection staff member will review and select an issue to be presented to the TWG. As part of the issue review process, the Identity Protection staff member will review the form and may follow up with the submitter for additional clarification. The selected issue will be added to the agenda and will be discussed during the TWG meeting. The TWG will attempt to resolve the issue and submit the procedural changes via a SERP alert, interim guidance, and/or IRM changes.

Guidelines for Selecting Systemic Issues to be Addressed by the TWG - The TWG provides a forum for discussing systemic issues and developing recommendations on how processes and procedures can be improved to reduce taxpayer burden. A systemic issue can be defined as an issue that meets any of the following criteria:

The TWG is focused on the issue of identity theft, therefore all systemic issues should be specifically related to incidents of identity theft. Identity theft is defined as an incident where someone uses another individual's personal information such as name, Social Security Number (SSN), or other identifying information, without permission, to commit fraud or deception. Each issue should meet one or more of the following criteria.

The Identity Theft Advisory Council (IDT AC) is part of a two-tiered governance process to address Servicewide identity theft efforts.

Sharing identity theft related information is the major role of the Council. This ensures all participants are equally informed regarding issues, trends, and identity theft initiatives. The IDT AC will make decisions about how to move forward on current and new initiatives and advise the Identity Theft Executive Steering Committee (IDT ESC) on initiatives requiring their action or decision.

The advisory role to the IDT ESC includes, but is not limited to, the following:

The Identity Protection Program shall institute measures to inform IRS personnel of their responsibilities for protecting taxpayers and employees against the loss, disclosure, or theft of their PII.

The Identity Protection Program also supports the annual Information Protection and Disclosure Mandatory Briefing managed by the Office of Privacy, which provides information regarding identity protection.